Proofpoint To Buy Phishing Simulation And Training Provider Wombat Security Technologies for $225M

Proofpoint said it plans to provide the industry's first-ever integration of market-leading protection and awareness offerings through its $225 million purchase of Wombat Security Technologies.

The Sunnyvale, Calif.-based vendor said the deal would allow it to fuse its advanced threat protection capabilities with Pittsburgh-based Wombat's real-time phishing simulation and cybersecurity awareness and training. This combination should provide enterprises with highly accurate insights into their employees' vulnerability to the real phishing attacks targeting them every day, the company said.

"There's no one better to deliver those types of capabilities than someone's who's in the market helping customers protect themselves from phishing attacks," Gary Steele, Proofpoint's CEO, told Wall Street analysts Tuesday.

[Related: Proofpoint To Buy Weblife For $60M To Enhance Personal Email Protection Capabilities]

Steele said Wombat stood out thanks to the breadth of its capabilities, its industry-leading technology as recognized by third-party experts like Gartner, and its proximity to research hub Carnegie Mellon University. Proofpoint looked at some options over the past two years, and was excited about Wombat's capabilities and its ability to fit into the company's business operations, said CFO Paul Auvil.

Purchasing Wombat will allow Proofpoint customers to use data from the most current phishing campaigns in their simulations, the company said. And collecting user-reported phishing threat data from Wombat's offering will allow Proofpoint to include data on phishing campaigns seen by non-Proofpoint customers, resulting in a more visible and intelligent platform.

Steele anticipates that Wombat's phishing simulation and online training capabilities will be sold separately, with each costing a 5,000-person company roughly $10 per user, per year. Approximately half of Proofpoint's customers consume two or more of the company's products today, Steele said, with 30 percent currently procuring three or more Proofpoint offerings.

The phishing simulation offering consists of organizations running simulated attacks on users and is focused on getting employees to be more security-aware and not click on malicious links or files, Steele said. Separate from that, Steele said Wombat also offers classic online training courses dedicated to making employees more security-aware as they do their jobs every day.

The acquisition is expected to close later this quarter, Proofpoint said, and the integrated toolset will be publicly available as part of Proofpoint's advanced email offering by the end of June. Wombat is expected to contribute between $30 million and $32 million of revenue in 2018 and reduce non-GAAP net income by $5 million to $6 million, according to Proofpoint. Wombat employs 192 people, according to LinkedIn.

Wombat's go-to-market motion is very similar to Proofpoint's, Steele said, although the company relies more heavily on an inside sales model and has enjoyed considerable success selling over the phone to customers. All of the sales associates will be cross-trained, Steele said, with some of the Wombat team overlaying the Proofpoint team at the onset to help with selling.

Proofpoint's stock fell $2.48 (2.42%) to $100.10 in after-hours trading Tuesday. The company also reported fourth quarter revenue of $145.4 million, up 36 percent from $106.8 million the year prior, and a GAAP net loss of $11 million, or $0.24 per share, improved from a net loss of $22.9 million, or $0.54 per share, the year prior.

For all of 2017, Proofpoint's revenue climbed to $515.3 million, up 37 percent from $375.5 million last year. And GAAP net loss came in at $84.3 million, or $1.91 per share, improved from a loss of $111.2 million, or $2.66 per share, in 2016.

This is Proofpoint's third acquisition since November, coming just three months after the company agreed to acquire messaging security and threat intelligence provider Cloudmark for $110 million and browser isolation offerings vendor Weblife.io for $60 million.

When determining which companies to acquire, Steele said Proofpoint focuses most heavily on the capabilities being requested by customers, the company's internal go-to-market strategy, and whether the valuation of the acquisition target seems reasonable or excessive.